This IP belongs to Vodacom.

It attempted to use the FTP server to distribute network scanning tools.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Kroger.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It attempted to perform a man-in-the-middle attack on the POP3 server.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

This IP belongs to CenturyLink.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

A series of unusual file transfers originated from this IP.

This particular IP attempted to exploit vulnerabilities in our web applications.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

This IP was involved in deploying stealthy credential stealers in our network.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.